Juniper Security Director Missing Authorization Vulnerability Allowing Unauthorized Access to Sensitive Resources

A missing authorization vulnerability exists in Juniper Networks Security Director version 24.4.1. This vulnerability allows an unauthenticated network-based attacker to read or modify multiple sensitive resources through the web interface. Several endpoints on the Security Director appliance fail to properly validate authorization, enabling attackers to access data beyond their authorized level. The accessed information could be used to retrieve additional data or conduct further attacks, potentially affecting downstream managed devices.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, allowing attackers to read or modify data that could be used to compromise downstream managed devices.

Remediation

Users can upgrade to Juniper Security Director Software Bundle Update 24.4.1-1703 or any subsequent release to address this vulnerability. Additionally, access lists or firewall filters can be used to restrict access to the web interface from trusted hosts.